Grav CMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Grav CMS versions 1.7.46 through 1.7.48. This vulnerability allows authenticated users with editing privileges to execute arbitrary code by exploiting the onerror attribute of the img element.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an authenticated user with permissions to edit pages can insert a script into the onerror attribute of an img element. When the image fails to load, the script will execute. This can be done through the admin interface by creating or editing a page and adding the malicious image tag.